diff --git a/README.md b/README.md
index b4a9ab0..df2cd3c 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 | `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
 | `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
 | `concat` | [jub0t/Concat](https://github.com/jub0t/Concat) — free and open-source CapCut replacement (a Slint window over a Rust video engine) | *built from source* | [concat](https://aur.archlinux.org/packages/concat) |
-| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | self-contained tarball | [concat-bin](https://aur.archlinux.org/packages/concat-bin) |
+| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | `.deb` | [concat-bin](https://aur.archlinux.org/packages/concat-bin) |
 | `concat-git` | [jub0t/Concat](https://github.com/jub0t/Concat) — `main` branch of `concat` | *built from source* | [concat-git](https://aur.archlinux.org/packages/concat-git) |
 | `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
 | `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | tarball | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
diff --git a/concat-bin/.SRCINFO b/concat-bin/.SRCINFO
index f191df4..27a9cd9 100644
--- a/concat-bin/.SRCINFO
+++ b/concat-bin/.SRCINFO
@@ -1,9 +1,10 @@
 pkgbase = concat-bin
 	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)
-	pkgver = 0.2.2
+	pkgver = 0.2.3
 	pkgrel = 1
 	url = https://github.com/jub0t/Concat
 	arch = x86_64
+	arch = aarch64
 	license = AGPL-3.0-or-later
 	license = GPL-3.0-or-later
 	depends = alsa-lib
@@ -23,9 +24,13 @@ pkgbase = concat-bin
 	depends = hicolor-icon-theme
 	provides = concat
 	conflicts = concat
+	noextract = concat-bin-0.2.3-x86_64.deb
+	noextract = concat-bin-0.2.3-aarch64.deb
 	options = !strip
 	options = !debug
-	source = concat-bin-0.2.2.tar.gz::https://github.com/jub0t/Concat/releases/download/v0.2.2/Concat-0.2.2-linux-x86_64.tar.gz
-	sha256sums = 9151e36948773b3d0d02256f1a8ee44580eec5d1fe48fdb31c2da3b2250a39ff
+	source_x86_64 = concat-bin-0.2.3-x86_64.deb::https://github.com/jub0t/Concat/releases/download/v0.2.3/Concat-0.2.3-linux-x86_64.deb
+	sha256sums_x86_64 = 01d2fb58521038a426429f1543ab2ec2359aa428a9dfd1b8948ce97b7d79c6c3
+	source_aarch64 = concat-bin-0.2.3-aarch64.deb::https://github.com/jub0t/Concat/releases/download/v0.2.3/Concat-0.2.3-linux-aarch64.deb
+	sha256sums_aarch64 = 3bd3f6bcfb165141b50b1ca2d3ab1b070f7e5a0e9f86a3c9ec121c4b5085a220
 
 pkgname = concat-bin
diff --git a/concat-bin/PKGBUILD b/concat-bin/PKGBUILD
index fd8285a..5958340 100644
--- a/concat-bin/PKGBUILD
+++ b/concat-bin/PKGBUILD
@@ -3,63 +3,62 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=concat-bin
-pkgver=0.2.2
+pkgver=0.2.3
 pkgrel=1
 pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://github.com/jub0t/Concat"
 # The binary is Concat under the AGPL; the FFmpeg libraries it ships beside
-# itself are a BtbN GPL build. Both licence texts land in the package: the
+# itself are a GPL build. Both licence texts land in the package: the
 # repository's LICENSE, and upstream's notices file, which is what names the
 # terms of everything linked in - FFmpeg, Slint under its GPL option,
 # whisper.cpp, sherpa-onnx.
 license=('AGPL-3.0-or-later' 'GPL-3.0-or-later')
-# Nothing is spawned at run time any more: FFmpeg is linked, whisper.cpp and
-# sherpa-onnx are compiled in. What is left is what the binary loads - the
-# ALSA backend of cpal, fontconfig and freetype for text, and the windowing
-# libraries winit and the renderer open by name: EGL, Wayland, X11 and
-# xkbcommon. dbus is the XDG portal, which is how the file dialogs and
-# "reveal in file manager" work without a toolkit.
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in, and ONNX Runtime ships in the same lib/
+# directory. What is left is what the binary loads by name - the ALSA backend
+# of cpal, fontconfig and freetype for text, and the windowing libraries
+# winit and the renderer open: EGL, Wayland, X11 and xkbcommon. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager" work
+# without a toolkit.
 depends=('alsa-lib' 'fontconfig' 'freetype2' 'libglvnd' 'libxkbcommon'
          'libxkbcommon-x11' 'libx11' 'libxcursor' 'libxi' 'libxrender'
          'wayland' 'dbus' 'gcc-libs' 'glibc' 'hicolor-icon-theme')
 provides=('concat')
 conflicts=('concat')
-# !strip: upstream's binary is already stripped, and the FFmpeg libraries
-# beside it are theirs to ship as they are.
+# !strip: upstream's binary is already stripped, and the FFmpeg and ONNX
+# Runtime libraries beside it are theirs to ship as they are.
 options=('!strip' '!debug')
-# Upstream's Linux release is one self-contained folder: the binary, the
-# FFmpeg 8.1 runtime libraries it was linked against, a desktop entry and an
-# icon. The libraries have to come along - the binary needs libavcodec.so.62
-# and Arch is on FFmpeg 9 (libavcodec.so.63) - so the whole folder is
-# installed under /usr/lib/$pkgname, where the binary's own rpath
-# ($ORIGIN/lib) finds them.
+# Upstream's Linux packages carry one self-contained folder: the binary and
+# the libraries it was linked against - FFmpeg 8 (Arch is on 9) and ONNX
+# Runtime, the cutout models' runtime. They go to /opt/concat, where the
+# binary's own rpath ($ORIGIN/lib) finds them, which is also where upstream's
+# .deb puts them and what its desktop entry points at.
 #
-# The asset name carries the workspace's version rather than the tag (a
-# prerelease of 0.2.2 ships Concat-0.2.2-linux-x86_64.tar.gz whatever its tag
-# says), so it is resolved through the GitHub API and synced here along with
-# the checksum; see pkg.sh.
-_tag="v0.2.2"
-_asset="Concat-0.2.2-linux-x86_64.tar.gz"
-source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/releases/download/${_tag}/${_asset}")
-sha256sums=('9151e36948773b3d0d02256f1a8ee44580eec5d1fe48fdb31c2da3b2250a39ff')
+# Of the three Linux artifacts - .deb, .rpm and AppImage - the .deb is the
+# plain one: an ar archive around that folder, with no runtime wrapped around
+# it and nothing to mount.
+#
+# The asset name carries the workspace's version, not the tag (a prerelease of
+# 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says), so both
+# the tag and that version are resolved through the release manifest and
+# synced here along with the checksums; see pkg.sh.
+_tag="v0.2.3"
+_relver="0.2.3"
+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-x86_64.deb")
+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-aarch64.deb")
+noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
+sha256sums_x86_64=('01d2fb58521038a426429f1543ab2ec2359aa428a9dfd1b8948ce97b7d79c6c3')
+sha256sums_aarch64=('3bd3f6bcfb165141b50b1ca2d3ab1b070f7e5a0e9f86a3c9ec121c4b5085a220')
 
 package() {
-  cd "${_asset%.tar.gz}"
+  # -p: lib/ is the usual set of soname symlinks beside the real files, and
+  # only an extraction that preserves them keeps the rpath working.
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" ./opt ./usr
 
-  install -Dm755 concat "$pkgdir/usr/lib/$pkgname/concat"
-  # cp, not install: lib/ is the usual set of FFmpeg soname symlinks beside
-  # the real files, and only a copy that preserves them keeps it working.
-  cp -a lib "$pkgdir/usr/lib/$pkgname/lib"
-
-  install -d "$pkgdir/usr/bin"
-  ln -s "/usr/lib/$pkgname/concat" "$pkgdir/usr/bin/concat"
-
-  install -Dm644 concat.desktop "$pkgdir/usr/share/applications/concat.desktop"
-  install -Dm644 concat.png \
-    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
-
-  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
-  install -Dm644 THIRD_PARTY_NOTICES.md \
-    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
+  # upstream ships them as documentation; on Arch they belong here
+  install -d "$pkgdir/usr/share/licenses"
+  mv "$pkgdir/usr/share/doc/concat" "$pkgdir/usr/share/licenses/$pkgname"
+  rmdir "$pkgdir/usr/share/doc"
 }
diff --git a/concat-bin/pkg.sh b/concat-bin/pkg.sh
index 7896519..368090c 100644
--- a/concat-bin/pkg.sh
+++ b/concat-bin/pkg.sh
@@ -1,14 +1,14 @@
 # concat-bin - Concat (https://github.com/jub0t/Concat), a free and
 # open-source CapCut replacement.
 #
-# Upstream publishes a self-contained Linux tarball per release, so there is
-# no build step here: on a new version only pkgver, the asset name and the
-# checksum are refreshed and the PKGBUILD repackages the tarball.
+# Upstream builds the Linux release itself, so there is no build step here:
+# on a new version the tag, the asset version and the checksums are refreshed
+# and the PKGBUILD repackages upstream's .deb.
 #
-# 0.2.1 is the first release of the rewrite: the Tauri shell and its .deb are
-# gone, and the app is now one Rust binary (Slint over the engine crates)
-# shipped as Concat-<version>-linux-<arch>.tar.gz. The tag is what changed
-# least - see below.
+# 0.2.3 replaced the self-contained tarball this package used to take with a
+# .deb, an .rpm and an AppImage, each for x86_64 and aarch64. Every release
+# also carries a manifest.json listing each artifact with its sha256, so a
+# new version costs two API calls and no download.
 #
 # The release list is not ordered by version: GitHub sorts it by creation
 # time, and upstream's alpha numbering has run out of step with it before
@@ -18,13 +18,12 @@
 # rolling "nightly" prerelease out.
 #
 # The asset name carries the workspace's version, not the tag - a prerelease
-# of 0.2.2 ships Concat-0.2.2-linux-x86_64.tar.gz whatever its tag says - so
-# it cannot be derived from pkgver and is resolved through the API into the
-# _asset variable.
+# of 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says - so it
+# cannot be derived from pkgver and is read from the manifest into _relver.
 #
-# pkgver drops the hyphens from the tag (v0.2.2-alpha.1 -> 0.2.2alpha.1).
-# pacman sorts that older than a later plain 0.2.2 (`vercmp 0.2.2alpha.1
-# 0.2.2` is -1), so prereleases upgrade to the eventual release on their own
+# pkgver drops the hyphens from the tag (v0.2.4-alpha.1 -> 0.2.4alpha.1).
+# pacman sorts that older than a later plain 0.2.4 (`vercmp 0.2.4alpha.1
+# 0.2.4` is -1), so prereleases upgrade to the eventual release on their own
 # and no epoch is needed.
 
 UPSTREAM_REPO="jub0t/Concat"
@@ -47,7 +46,7 @@ latest_version() {
 # refresh_checksums <version> <pkgbuild-path>
 refresh_checksums() {
   local ver="$1" pkgbuild="$2"
-  local tag asset sha
+  local tag manifest relver sha_x86_64 sha_aarch64 arch sha file
 
   tag="$(latest_tag)"
   if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
@@ -55,23 +54,31 @@ refresh_checksums() {
     return 1
   fi
 
-  # e.g. Concat-0.2.1-linux-x86_64.tar.gz - the version is the workspace's,
-  # not the tag's
-  # `|| true`, so that a release that stops carrying the asset says so here
-  # instead of ending the run on grep's exit status with nothing printed.
-  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
-    | grep -E '^Concat-.*-linux-x86_64\.tar\.gz$' || true)"
-  if [[ -z "$asset" || "$(wc -l <<< "$asset")" -ne 1 ]]; then
-    echo "expected exactly one linux-x86_64 tarball in $tag, got: ${asset:-none}" >&2
+  manifest="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/manifest.json")"
+  relver="$(jq -r '.version // empty' <<< "$manifest" 2>/dev/null)"
+  if [[ -z "$relver" ]]; then
+    echo "$tag carries no usable manifest.json" >&2
     return 1
   fi
 
-  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
-    | sha256sum | cut -d' ' -f1)"
+  # Both the name and the checksum come from the manifest, and the name is
+  # checked against what the PKGBUILD builds from _relver: a release that
+  # renames its artifacts says so here instead of 404ing in the test build.
+  for arch in x86_64 aarch64; do
+    sha="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.sha256 // empty' <<< "$manifest")"
+    file="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.file // empty' <<< "$manifest")"
+    if [[ ! "$sha" =~ ^[0-9a-f]{64}$ || "$file" != "Concat-$relver-linux-$arch.deb" ]]; then
+      echo "$tag's manifest lists no Concat-$relver-linux-$arch.deb with a sha256" \
+           "(file: ${file:-none})" >&2
+      return 1
+    fi
+    printf -v "sha_$arch" '%s' "$sha"
+  done
 
   sed -i \
     -e "s|^_tag=.*|_tag=\"$tag\"|" \
-    -e "s|^_asset=.*|_asset=\"$asset\"|" \
-    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    -e "s|^_relver=.*|_relver=\"$relver\"|" \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x86_64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_aarch64')|" \
     "$pkgbuild"
 }
diff --git a/concat-git/.SRCINFO b/concat-git/.SRCINFO
index 6dde00f..1f3d288 100644
--- a/concat-git/.SRCINFO
+++ b/concat-git/.SRCINFO
@@ -11,6 +11,7 @@ pkgbase = concat-git
 	makedepends = pkgconf
 	makedepends = git
 	depends = ffmpeg
+	depends = onnxruntime
 	depends = alsa-lib
 	depends = fontconfig
 	depends = freetype2
diff --git a/concat-git/PKGBUILD b/concat-git/PKGBUILD
index 00cfc84..fac4299 100644
--- a/concat-git/PKGBUILD
+++ b/concat-git/PKGBUILD
@@ -15,11 +15,12 @@ license=('AGPL-3.0-or-later')
 # vulkan-icd-loader are the two backends wgpu picks between, and the rest is
 # what winit opens by name for whichever session the user is in. dbus is the
 # XDG portal, which is how the file dialogs and "reveal in file manager"
-# work without a toolkit.
-depends=('ffmpeg' 'alsa-lib' 'fontconfig' 'freetype2' 'libglvnd'
-         'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11' 'libx11'
-         'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus' 'gcc-libs'
-         'glibc' 'hicolor-icon-theme')
+# work without a toolkit. onnxruntime runs the cutout models and is linked
+# dynamically, see ORT_LIB_LOCATION in build().
+depends=('ffmpeg' 'onnxruntime' 'alsa-lib' 'fontconfig' 'freetype2'
+         'libglvnd' 'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11'
+         'libx11' 'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme')
 # clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
 # cmake: whisper.cpp is compiled in, by its own CMake build.
 makedepends=('rust' 'cmake' 'clang' 'pkgconf' 'git')
@@ -42,17 +43,27 @@ pkgver() {
 }
 
 prepare() {
-  cd "$pkgname/engine"
+  cd "$pkgname/src"
 
   export RUSTUP_TOOLCHAIN=stable
   cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
 }
 
 build() {
-  cd "$pkgname/engine"
+  cd "$pkgname/src"
 
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
+  # ort, the ONNX Runtime binding behind the cutout models, downloads a
+  # prebuilt runtime from its build script unless it is pointed at one. Arch
+  # has the library, so it is linked against that instead - dynamically, so
+  # the package follows onnxruntime's updates rather than freezing a copy.
+  # Upstream's flake.nix does the same with nixpkgs' onnxruntime.
+  export ORT_LIB_LOCATION=/usr/lib
+  export ORT_PREFER_DYNAMIC_LINK=1
+  # and if that ever stops being picked up, fail the build instead of
+  # quietly falling back to the download
+  export ORT_SKIP_DOWNLOAD=1
   # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
   # on unless told otherwise. A package is not always built on the machine it
   # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
@@ -65,7 +76,7 @@ build() {
   # choice, for the same reason, that upstream's flake.nix makes.
   #
   # --profile app: upstream's shipping profile - fat LTO, panic=abort,
-  # stripped. See engine/Cargo.toml for what each knob is for.
+  # stripped. See src/Cargo.toml for what each knob is for.
   #
   # sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
   # script downloads a prebuilt static-lib archive from its own release page.
@@ -78,17 +89,18 @@ build() {
 package() {
   cd "$pkgname"
 
-  install -Dm755 "engine/target/app/concat" "$pkgdir/usr/bin/concat"
+  install -Dm755 "src/target/app/concat" "$pkgdir/usr/bin/concat"
 
-  # The desktop entry upstream's release workflow writes into the Linux
-  # tarball; there is none in the tree, because the Nix build generates its
-  # own. Reproduced here so this package and concat-bin install the same one.
+  # The desktop entry upstream's release workflow writes into its Linux
+  # packages; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here, with the Exec line pointing at this package's
+  # binary rather than at the /opt folder upstream's .deb installs.
   install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
 [Desktop Entry]
 Type=Application
 Name=Concat
 Comment=Video editor
-Exec=concat
+Exec=concat %U
 Icon=concat
 Categories=AudioVideo;Video;
 Terminal=false
diff --git a/concat-git/pkg.sh b/concat-git/pkg.sh
index a8577c0..c17fcf1 100644
--- a/concat-git/pkg.sh
+++ b/concat-git/pkg.sh
@@ -20,7 +20,7 @@
 # part of the test build, so the committed snapshot follows along by itself.
 
 # Installed in CI (pacman) before the makepkg test build.
-BUILD_DEPS=(rust cmake clang pkgconf git ffmpeg alsa-lib fontconfig freetype2)
+BUILD_DEPS=(rust cmake clang pkgconf git ffmpeg onnxruntime-cpu alsa-lib fontconfig freetype2)
 
 latest_version() {
   grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
diff --git a/concat/.SRCINFO b/concat/.SRCINFO
index c0e902f..ded1da2 100644
--- a/concat/.SRCINFO
+++ b/concat/.SRCINFO
@@ -10,6 +10,7 @@ pkgbase = concat
 	makedepends = clang
 	makedepends = pkgconf
 	depends = ffmpeg
+	depends = onnxruntime
 	depends = alsa-lib
 	depends = fontconfig
 	depends = freetype2
diff --git a/concat/PKGBUILD b/concat/PKGBUILD
index 6418631..fab54db 100644
--- a/concat/PKGBUILD
+++ b/concat/PKGBUILD
@@ -15,11 +15,12 @@ license=('AGPL-3.0-or-later')
 # vulkan-icd-loader are the two backends wgpu picks between, and the rest is
 # what winit opens by name for whichever session the user is in. dbus is the
 # XDG portal, which is how the file dialogs and "reveal in file manager"
-# work without a toolkit.
-depends=('ffmpeg' 'alsa-lib' 'fontconfig' 'freetype2' 'libglvnd'
-         'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11' 'libx11'
-         'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus' 'gcc-libs'
-         'glibc' 'hicolor-icon-theme')
+# work without a toolkit. onnxruntime runs the cutout models and is linked
+# dynamically, see ORT_LIB_LOCATION in build().
+depends=('ffmpeg' 'onnxruntime' 'alsa-lib' 'fontconfig' 'freetype2'
+         'libglvnd' 'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11'
+         'libx11' 'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme')
 # clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
 # cmake: whisper.cpp is compiled in, by its own CMake build.
 makedepends=('rust' 'cmake' 'clang' 'pkgconf')
@@ -48,19 +49,29 @@ sha256sums=('2534fa8eac80b42a672a566d7f9a9965a8f6358b66dc18a9c7ae1b5bbdd5d2b6' '
 _srcname="Concat-${_tag#v}"
 
 prepare() {
-  cd "$_srcname/engine"
+  cd "$_srcname/src"
 
   export RUSTUP_TOOLCHAIN=stable
   cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
 }
 
 build() {
-  cd "$_srcname/engine"
+  cd "$_srcname/src"
 
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
   # the checksummed archive from source[1], instead of a download in build()
   export SHERPA_ONNX_ARCHIVE_DIR="$srcdir"
+  # ort, the ONNX Runtime binding behind the cutout models, downloads a
+  # prebuilt runtime from its build script unless it is pointed at one. Arch
+  # has the library, so it is linked against that instead - dynamically, so
+  # the package follows onnxruntime's updates rather than freezing a copy.
+  # Upstream's flake.nix does the same with nixpkgs' onnxruntime.
+  export ORT_LIB_LOCATION=/usr/lib
+  export ORT_PREFER_DYNAMIC_LINK=1
+  # and if that ever stops being picked up, fail the build instead of
+  # quietly falling back to the download
+  export ORT_SKIP_DOWNLOAD=1
   # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
   # on unless told otherwise. A package is not always built on the machine it
   # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
@@ -73,7 +84,7 @@ build() {
   # choice, for the same reason, that upstream's flake.nix makes.
   #
   # --profile app: upstream's shipping profile - fat LTO, panic=abort,
-  # stripped. See engine/Cargo.toml for what each knob is for.
+  # stripped. See src/Cargo.toml for what each knob is for.
   cargo build --profile app -p concat --frozen \
     --no-default-features --features wgpu
 }
@@ -81,17 +92,18 @@ build() {
 package() {
   cd "$_srcname"
 
-  install -Dm755 "engine/target/app/concat" "$pkgdir/usr/bin/concat"
+  install -Dm755 "src/target/app/concat" "$pkgdir/usr/bin/concat"
 
-  # The desktop entry upstream's release workflow writes into the Linux
-  # tarball; there is none in the tree, because the Nix build generates its
-  # own. Reproduced here so this package and concat-bin install the same one.
+  # The desktop entry upstream's release workflow writes into its Linux
+  # packages; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here, with the Exec line pointing at this package's
+  # binary rather than at the /opt folder upstream's .deb installs.
   install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
 [Desktop Entry]
 Type=Application
 Name=Concat
 Comment=Video editor
-Exec=concat
+Exec=concat %U
 Icon=concat
 Categories=AudioVideo;Video;
 Terminal=false
diff --git a/concat/pkg.sh b/concat/pkg.sh
index 18e0b7c..585a49f 100644
--- a/concat/pkg.sh
+++ b/concat/pkg.sh
@@ -24,7 +24,7 @@
 UPSTREAM_REPO="jub0t/Concat"
 
 # Installed in CI (pacman) before the makepkg test build.
-BUILD_DEPS=(rust cmake clang pkgconf ffmpeg alsa-lib fontconfig freetype2)
+BUILD_DEPS=(rust cmake clang pkgconf ffmpeg onnxruntime-cpu alsa-lib fontconfig freetype2)
 
 latest_tag() {
   gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
@@ -65,13 +65,13 @@ refresh_checksums() {
   # `|| true`, so that a tree that has moved the lockfile or dropped the crate
   # is reported below instead of ending the run on grep's exit status with
   # nothing printed.
-  sherpa="$(tar -xOzf "$tarball" --wildcards '*/engine/Cargo.lock' \
+  sherpa="$(tar -xOzf "$tarball" --wildcards '*/src/Cargo.lock' \
     | grep -A2 '^name = "sherpa-onnx-sys"' | sed -n 's/^version = "\(.*\)"/\1/p' \
     || true)"
   rm -f "$tarball"
 
   if [[ -z "$sherpa" ]]; then
-    echo "could not read the sherpa-onnx-sys version from $tag's Cargo.lock" >&2
+    echo "could not read the sherpa-onnx-sys version from $tag's src/Cargo.lock" >&2
     return 1
   fi